SPLK-1002 Matching — 10 Questions

Question 1

Match each Splunk index time field to its meaning.

Accepted Answer

host: The name of the host from which the event originated. Index time fields are automatically added to events during indexing. The correct matches are: host (origin host), source (input file/stream), sourcetype (data type), and _time (event timestamp). Common confusions include swapping source with _time or sourcetype with host.

Answer

source: The timestamp of the event, in epoch time

Answer

sourcetype: The name of the host from which the event originated

Question 2

Match each Splunk component to its function.

Accepted Answer

Search Head: Distributes search requests and merges results from indexers.. In a Splunk distributed environment, the Search Head handles search distribution and result merging, the Indexer indexes and stores data, the Universal Forwarder collects and forwards data, and the Deployment Server manages configuration deployment. Common mistakes include swapping the roles of Search Head and Indexer, or confusing the Deployment Server with a forwarder.

Answer

Search Head: Indexes and stores incoming data.

Answer

Deployment Server: Lightweight forwarder that sends data to indexers.

Question 3

Match each Splunk search command to its primary function.

Accepted Answer

eval: Evaluate expressions and assign to new fields. These are common Splunk search commands used for data manipulation and enrichment.

Answer

eval: Extract fields using regular expressions

Answer

stats: Enrich events with data from external sources

Question 4

Match each Splunk macro to its definition.

Accepted Answer

mvfilter: Filters multivalue fields based on a condition.. The correct matches are: mvfilter for filtering multivalue fields, dedup for removing duplicates, fields for removing fields, and rename for renaming fields. Common confusions include associating dedup with time formatting and fields with sorting.

Answer

dedup: Changes the time format of events.

Answer

fields: Sorts results by a field.

Question 5

Match each Splunk report type to its description.

Accepted Answer

Table Report: Displays raw or transformed data in a tabular format with rows and columns.. In Splunk, report types define how data is presented. Table Reports show raw data in rows/columns, Chart Reports use graphs, Single Value Reports show one key metric, and Statistics Reports summarize data. Common confusions arise between Table/Statistics and Chart/Single Value.

Answer

Table Report: Displays summary statistics with counts and averages.

Answer

Chart Report: Displays a single numerical value with a sparkline.

Question 6

Match each Splunk role to its typical permission level.

Accepted Answer

admin: Full access to all Splunk features. Splunk roles determine user permissions: admin grants full access, power allows most features except administrative functions, and user restricts to own data and basic searches.

Answer

admin: Access to only search and reports

Answer

power: Full access to all Splunk features

Question 7

Match each Splunk knowledge object to its purpose.

Accepted Answer

Event types: Categorize events based on search criteria.. Knowledge objects in Splunk help organize and enrich data. Event types group events by criteria, Tags label field values, Lookups add external data, and Macros store reusable search fragments. Common confusions arise between these similar but distinct objects.

Answer

Event types: Add descriptive keywords to field values.

Answer

Tags: Categorize events based on search criteria.

Answer

Lookups: Reusable search fragments.

Question 8

Match each Splunk license violation type to its consequence.

Accepted Answer

Warning: Splunk continues to function normally but license warnings appear in the Monitoring Console.. Splunk license violations have two states: Warning (grace period with alerts) and Violation (search restricted for non-admins). Common mistakes include confusing the two or expecting immediate indexing stoppage.

Answer

Warning: Search is disabled for all users until license is renewed.

Answer

Violation: Splunk continues to function normally with no visible changes.

Answer

Warning: Indexing stops and all data ingestion is paused.

Answer

Violation: License warnings appear only in the Monitoring Console, no other impact.

Question 9

Match each Splunk search mode to its behavior.

Accepted Answer

Fast: Optimized for speed and returns only aggregate data.. Search modes control Splunk's behavior: Fast for speed (summary data), Verbose for completeness (all data), Smart as default balance. Common confusions involve swapping these definitions.

Answer

Fast: Returns all fields and all events.

Answer

Verbose: Optimized for speed.

Answer

Smart: Returns only summary data.

Question 10

Match each Splunk search operator to its behavior.

Accepted Answer

AND: Returns results that match both terms. The correct matches are: AND combines with both, OR with either, NOT excludes. Common confusion is swapping AND and OR.

Answer

AND: Returns results that match either term

Answer

OR: Returns results that match both terms